ImageMagick EUVD-2026-97369

Exploitation requires (1) an existing local account on the host and the ability to create symbolic links, and (2) that the deployment actually enforces ImageMagick security policies via policy.xml using IsRightsAuthorizedByName as a restriction mechanism - if no such policy is configured, there is nothing to bypass. The attacker points a symlink at a policy-restricted path so the rights check evaluates the wrong target. Limiting factors: the vector is local only (AV:L) with no network reachability, it requires low privileges (PR:L) rather than anonymous access, it is high-complexity with a specific attack requirement (AC:H/AT:P) reflecting the TOCTOU/symlink-handling conditions, and impact is confined to confidentiality and integrity at a low level with no availability impact (VA:N). Environments that do not rely on ImageMagick policies as a trust boundary against local users are effectively unaffected.

This is a genuinely low-priority issue by every available signal, and the signals are mutually consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:N, impacts VC:L/VI:L/VA:N) scores 2.0 and describes a local, high-complexity, low-privilege attack with only limited confidentiality/integrity impact and no availability impact - characteristics of a defense-in-depth weakness, not a remotely weaponizable flaw. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis to accelerate adoption. No EPSS score was provided in the input; its absence is not itself a risk signal and should not be treated as one. There is no SSVC decision data in the input. The core nature of the bug - a TOCTOU-style symlink gap (CWE-59) in ImageMagick's IsRightsAuthorizedByName policy check - means the 'impact' is bypass of an administrator-configured hardening policy (policy.xml), so real-world risk is almost entirely a function of whether an environment relies on ImageMagick security policies as a security boundary against already-local users. Bottom line: a legitimate hardening regression worth patching during routine maintenance, but not an emergency.

A local user on a shared host (e.g., a multi-tenant web/image-processing server where ImageMagick policies restrict access to sensitive coders or paths) creates a symbolic link whose name resolves past the IsRightsAuthorizedByName check but whose target points to a policy-restricted path, causing the configured policy.xml restriction to be evaluated against the wrong path and bypassed. Because the CVSS vector is AV:L/AC:H/PR:L, this requires an existing local foothold with the ability to create symlinks and succeeds only under the high-complexity conditions the check mishandles. No public exploit identified at time of analysis.